feat(menu): Tailscale exit-node rows show country/city

The Exit node picker listed bare hostnames; Mullvad-style nodes are
meaningless without their location. Rows are now
"hostname  — Country City", sliced from `tailscale exit-node list` by
the header's fixed-width column offsets (COUNTRY/CITY can be
multi-word, so field splitting is wrong by construction); nodes without
a location stay a bare hostname, and the pick strips back to the
hostname at the first space before `tailscale set --exit-node`.

Closes BACKLOG LATER "VPN exit-node richer display"; the VPN
HARDWARE-QUEUE entry now covers the location rows.

Verification: V1 — the awk was proven against a fabricated fixture
(one-word city, multi-word "United States / New York, NY", bare
self-hosted node), flake check exit 0, downstream-template-home builds
(writeShellScriptBin syntax-gates the script). Real `tailscale
exit-node list` output stays V3 (existing VPN menu live-paths entry).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/HARDWARE-QUEUE.md

@@ -99,6 +99,10 @@ the **T14s** (webcam case).
 - [ ] **VPN menu live paths** — import a real WireGuard `.conf` and an
       `.ovpn` via System → VPN, toggle up/down (● / ○ state), and the
       Tailscale block: up/down + exit-node without sudo (operator grant).
+      Exit-node rows now show "hostname — Country City" (2026-07-11,
+      header-offset parsing): confirm Mullvad-style nodes carry their
+      location, a locationless self-hosted node stays a bare hostname,
+      and picking either still sets the node (`tailscale status` shows it).
 - [ ] **Printer menu** — with `nomarchy.services.printing`, System →
       Printers opens system-config-printer; add a printer, test page.
 - [ ] **GRUB UEFI ISO theme render** — boot the ISO on UEFI hardware: